mycode-cli 0.6.0__tar.gz → 0.7.1__tar.gz

{mycode_cli-0.6.0 → mycode_cli-0.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mycode-cli
-Version: 0.6.0
+Version: 0.7.1
 Summary: Minimal coding agent CLI and web UI built on mycode-sdk.
 Project-URL: Homepage, https://github.com/legibet/mycode
 Project-URL: Repository, https://github.com/legibet/mycode
@@ -22,7 +22,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Software Development
 Requires-Python: >=3.12
 Requires-Dist: fastapi>=0.115.0
-Requires-Dist: mycode-sdk==0.6.0
+Requires-Dist: mycode-sdk==0.7.1
 Requires-Dist: prompt-toolkit>=3.0.52
 Requires-Dist: pyyaml>=6.0.0
 Requires-Dist: rich>=14.2.0
@@ -89,7 +89,7 @@ Run `/model` in tui to see the available models.
 
 A config file is optional — API keys from the environment are usually sufficient.
 
-Create `~/.mycode/config.json` (global) or `<workspace>/.mycode/config.json` (project, takes precedence) to:
+Create `~/.mycode/config.json` (global) or `.mycode/config.json` under the current project to:
 
 - set a default provider, model, and reasoning effort
 - expose additional models on an existing provider (e.g. OpenRouter's catalog)

{mycode_cli-0.6.0 → mycode_cli-0.7.1}/README.md

@@ -57,7 +57,7 @@ Run `/model` in tui to see the available models.
 
 A config file is optional — API keys from the environment are usually sufficient.
 
-Create `~/.mycode/config.json` (global) or `<workspace>/.mycode/config.json` (project, takes precedence) to:
+Create `~/.mycode/config.json` (global) or `.mycode/config.json` under the current project to:
 
 - set a default provider, model, and reasoning effort
 - expose additional models on an existing provider (e.g. OpenRouter's catalog)

{mycode_cli-0.6.0 → mycode_cli-0.7.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "mycode-cli"
-version = "0.6.0"
+version = "0.7.1"
 description = "Minimal coding agent CLI and web UI built on mycode-sdk."
 requires-python = ">=3.12"
 license = "MIT"
@@ -26,7 +26,7 @@ classifiers = [
 ]
 keywords = ["agent", "cli", "llm", "coding-agent", "fastapi"]
 dependencies = [
-    "mycode-sdk==0.6.0",
+    "mycode-sdk==0.7.1",
     "fastapi>=0.115.0",
     "uvicorn[standard]>=0.32.0",
     "rich>=14.2.0",

{mycode_cli-0.6.0 → mycode_cli-0.7.1}/src/mycode_cli/config.py

@@ -8,7 +8,7 @@ import os
 import re
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Any
+from typing import Any, Literal
 
 from mycode.models import resolve_model_metadata
 from mycode.providers import (
@@ -42,9 +42,14 @@ _API_KEY_ENV_REF_RE = re.compile(r"^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$")
 # Full set of user-facing choices. "auto" means "do not send an explicit effort
 # to the provider" and is represented internally as `None` after normalization.
 REASONING_EFFORT_OPTIONS = ("auto", "none", "low", "medium", "high", "xhigh")
+PERMISSION_LEVEL_OPTIONS = ("readonly", "safe", "standard", "yolo")
+PERMISSION_MODE_OPTIONS = ("ask", "deny")
 _EFFORT_AUTO_ALIASES = frozenset({"", "auto", "default"})
 _EFFORT_OFF_ALIASES = frozenset({"off", "disabled"})
 
+PermissionLevel = Literal["readonly", "safe", "standard", "yolo"]
+PermissionMode = Literal["ask", "deny"]
+
 
 @dataclass(frozen=True)
 class ModelConfig:
@@ -66,6 +71,12 @@ class ProviderConfig:
     reasoning_effort: str | None = None
 
 
+@dataclass(frozen=True)
+class PermissionConfig:
+    level: PermissionLevel = "safe"
+    mode: PermissionMode = "ask"
+
+
 @dataclass(frozen=True)
 class Settings:
     providers: dict[str, ProviderConfig]
@@ -73,9 +84,10 @@ class Settings:
     default_model: str | None
     port: int
     cwd: str
-    workspace_root: str
+    project: str
     default_reasoning_effort: str | None = None
     compact_threshold: float | None = None
+    permission: PermissionConfig = field(default_factory=PermissionConfig)
     config_paths: list[str] = field(default_factory=list)
 
 
@@ -91,16 +103,6 @@ class ResolvedProvider:
     provider_name: str | None = None
 
 
-def find_workspace_root(cwd: str) -> Path:
-    """Resolve the project/workspace root for the current cwd."""
-
-    current = Path(cwd).expanduser().resolve(strict=False)
-    for parent in [current, *current.parents]:
-        if (parent / ".git").exists():
-            return parent
-    return current
-
-
 def _load_json(path: Path) -> dict[str, Any] | None:
     if not path.is_file():
         return None
@@ -111,6 +113,32 @@ def _load_json(path: Path) -> dict[str, Any] | None:
     return data if isinstance(data, dict) else None
 
 
+def resolve_project(cwd: str) -> Path:
+    """Return the nearest Git project root, or cwd when no .git is found."""
+
+    cwd_path = Path(cwd).expanduser().resolve(strict=False)
+    for path in (cwd_path, *cwd_path.parents):
+        if (path / ".git").exists():
+            return path
+    return cwd_path
+
+
+def project_dirs(cwd: str, project: str | Path | None = None) -> list[Path]:
+    """Return directories from project to cwd, inclusive."""
+
+    cwd_path = Path(cwd).expanduser().resolve(strict=False)
+    project_path = Path(project).expanduser().resolve(strict=False) if project is not None else resolve_project(cwd)
+
+    dirs = [cwd_path]
+    while dirs[-1] != project_path:
+        parent = dirs[-1].parent
+        if parent == dirs[-1]:
+            break
+        dirs.append(parent)
+
+    return list(reversed(dirs))
+
+
 def _normalize_models(value: Any) -> dict[str, ModelConfig]:
     if not isinstance(value, dict):
         return {}
@@ -197,6 +225,39 @@ def normalize_reasoning_effort(value: Any) -> str | None:
     raise ValueError(f"unsupported reasoning_effort {value!r}; supported: {supported}")
 
 
+def normalize_permission_level(value: Any) -> PermissionLevel:
+    if not isinstance(value, str):
+        raise ValueError(f"permission level must be a string, got {type(value).__name__}")
+    level = value.strip().lower()
+    if level in PERMISSION_LEVEL_OPTIONS:
+        return level
+    supported = ", ".join(PERMISSION_LEVEL_OPTIONS)
+    raise ValueError(f"unsupported permission level {value!r}; supported: {supported}")
+
+
+def normalize_permission_mode(value: Any) -> PermissionMode:
+    if not isinstance(value, str):
+        raise ValueError(f"permission mode must be a string, got {type(value).__name__}")
+    mode = value.strip().lower()
+    if mode in PERMISSION_MODE_OPTIONS:
+        return mode
+    supported = ", ".join(PERMISSION_MODE_OPTIONS)
+    raise ValueError(f"unsupported permission mode {value!r}; supported: {supported}")
+
+
+def parse_permission(value: Any, current: PermissionConfig | None = None) -> PermissionConfig:
+    base = current or PermissionConfig()
+    if value is None:
+        return base
+    if isinstance(value, str):
+        return PermissionConfig(level=normalize_permission_level(value), mode=base.mode)
+    if isinstance(value, dict):
+        level = normalize_permission_level(value.get("level")) if "level" in value else base.level
+        mode = normalize_permission_mode(value.get("mode")) if "mode" in value else base.mode
+        return PermissionConfig(level=level, mode=mode)
+    raise ValueError(f"permission must be a string or object, got {type(value).__name__}")
+
+
 def _config_api_key_from_env_var(provider: ProviderConfig, *, require: bool = False) -> str | None:
     env_name = provider.api_key_env_var
     if not env_name:
@@ -219,12 +280,10 @@ def provider_has_api_key(provider: ProviderConfig) -> bool:
     return bool(provider.api_key or provider_api_key_from_env(provider.type))
 
 
-def _candidate_config_paths(cwd: str) -> list[Path]:
-    workspace_root = find_workspace_root(cwd)
-    return [
-        resolve_mycode_home() / "config.json",
-        workspace_root / ".mycode" / "config.json",
-    ]
+def _candidate_config_paths(cwd: str, project: str | Path) -> list[Path]:
+    paths = [resolve_mycode_home() / "config.json"]
+    paths.extend(path / ".mycode" / "config.json" for path in project_dirs(cwd, project))
+    return paths
 
 
 def _build_providers(raw_providers: dict[str, dict[str, Any]]) -> dict[str, ProviderConfig]:
@@ -257,19 +316,20 @@ def _build_providers(raw_providers: dict[str, dict[str, Any]]) -> dict[str, Prov
 
 
 def get_settings(cwd: str | None = None) -> Settings:
-    """Load settings from global and workspace config files."""
+    """Load settings from global and project config files."""
 
     resolved_cwd = str(Path(cwd or os.getcwd()).expanduser().resolve(strict=False))
-    workspace_root = find_workspace_root(resolved_cwd)
+    resolved_project = str(resolve_project(resolved_cwd))
 
     raw_providers: dict[str, dict[str, Any]] = {}
     default_provider: str | None = None
     default_model: str | None = None
     default_reasoning_effort: str | None = None
     compact_threshold: float | None = None
+    permission = PermissionConfig()
     config_paths: list[str] = []
 
-    for path in _candidate_config_paths(resolved_cwd):
+    for path in _candidate_config_paths(resolved_cwd, resolved_project):
         data = _load_json(path)
         if data is None:
             continue
@@ -315,15 +375,19 @@ def get_settings(cwd: str | None = None) -> Settings:
                 if parsed_threshold is not None:
                     compact_threshold = parsed_threshold
 
+        if "permission" in data:
+            permission = parse_permission(data.get("permission"), permission)
+
     return Settings(
         providers=_build_providers(raw_providers),
         default_provider=default_provider,
         default_model=default_model,
         default_reasoning_effort=normalize_reasoning_effort(default_reasoning_effort),
         compact_threshold=compact_threshold,
+        permission=permission,
         port=int(os.environ.get("PORT", "8000")),
         cwd=resolved_cwd,
-        workspace_root=str(workspace_root),
+        project=resolved_project,
         config_paths=config_paths,
     )
 
@@ -368,7 +432,7 @@ def resolve_provider(
     checked = ", ".join(env_names) or "<api key env>"
     raise ValueError(
         "no available providers found; set one of the supported API key env vars "
-        + f"({checked}) or configure a provider in ~/.mycode/config.json or <workspace>/.mycode/config.json"
+        + f"({checked}) or configure a provider in ~/.mycode/config.json or a project .mycode/config.json"
     )
 
 

{mycode_cli-0.6.0 → mycode_cli-0.7.1}/src/mycode_cli/main.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 import asyncio
 import os
 import sys
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 from typing import Annotated
 
 import typer
@@ -14,7 +14,15 @@ from mycode.agent import Agent
 from mycode.messages import ConversationMessage
 from mycode.session import SessionStore
 from mycode_cli import __version__
-from mycode_cli.config import ResolvedProvider, Settings, get_settings, resolve_provider, resolve_sessions_dir
+from mycode_cli.config import (
+    ResolvedProvider,
+    Settings,
+    get_settings,
+    parse_permission,
+    resolve_provider,
+    resolve_sessions_dir,
+)
+from mycode_cli.permissions import PERMISSION_DENIED_BY_USER_OUTPUT, PERMISSION_DENIED_OUTPUT
 
 from .runtime import ResolvedSession, build_agent, resolve_session
 from .tui.chat import TerminalChat
@@ -46,10 +54,10 @@ async def run_noninteractive(agent: Agent, message: str) -> int:
     async for event in agent.achat(message, on_persist=track):
         if event.type == "error":
             error_message = str(event.data.get("message") or "agent error")
-
-    if error_message:
-        print(error_message, file=sys.stderr)
-        return 1
+        elif event.type == "tool_done" and event.data.get("is_error"):
+            output = str(event.data.get("output") or "")
+            if output in {PERMISSION_DENIED_OUTPUT, PERMISSION_DENIED_BY_USER_OUTPUT}:
+                error_message = output
 
     reply = ""
     if latest_assistant:
@@ -63,6 +71,12 @@ async def run_noninteractive(agent: Agent, message: str) -> int:
         sys.stdout.write(reply)
         if not reply.endswith("\n"):
             sys.stdout.write("\n")
+
+    if error_message:
+        if not reply:
+            print(error_message, file=sys.stderr)
+        return 1
+
     return 0
 
 
@@ -83,6 +97,7 @@ def _bootstrap(
     session: str | None,
     continue_last: bool,
     max_turns: int | None,
+    permission: str | None,
 ) -> _BootstrapContext:
     """Shared setup for the chat and run commands."""
 
@@ -92,9 +107,10 @@ def _bootstrap(
     cwd = os.path.abspath(os.getcwd())
     store = SessionStore(data_dir=resolve_sessions_dir())
     view = TerminalView()
-    settings = get_settings(cwd)
-
     try:
+        settings = get_settings(cwd)
+        if permission is not None:
+            settings = replace(settings, permission=parse_permission(permission, settings.permission))
         resolved_provider = resolve_provider(settings, provider_name=provider, model=model)
         resolved_session = asyncio.run(
             resolve_session(
@@ -136,6 +152,10 @@ def chat(
     provider: Annotated[str | None, typer.Option(help="Provider id or configured alias")] = None,
     model: Annotated[str | None, typer.Option(help="Model name (overrides default)")] = None,
     max_turns: Annotated[int | None, typer.Option(min=1, help="Limit agent loop turns")] = None,
+    permission: Annotated[
+        str | None,
+        typer.Option("--permission", help="Permission level: readonly, safe, standard, yolo"),
+    ] = None,
     session: Annotated[str | None, typer.Option(help="Resume a specific session id")] = None,
     continue_last: Annotated[bool, typer.Option("--continue", "-c", help="Resume the most recent session")] = False,
     version: Annotated[
@@ -146,7 +166,6 @@ def chat(
             callback=_show_version,
             help="Show version and exit.",
             is_eager=True,
-            is_flag=True,
         ),
     ] = False,
 ) -> None:
@@ -164,6 +183,7 @@ def chat(
         session=session,
         continue_last=continue_last,
         max_turns=max_turns,
+        permission=permission,
     )
 
     setup.view.print_header(
@@ -197,6 +217,10 @@ def run(
     provider: Annotated[str | None, typer.Option(help="Provider id or configured alias")] = None,
     model: Annotated[str | None, typer.Option(help="Model name (overrides default)")] = None,
     max_turns: Annotated[int | None, typer.Option(min=1, help="Limit agent loop turns")] = None,
+    permission: Annotated[
+        str | None,
+        typer.Option("--permission", help="Permission level: readonly, safe, standard, yolo"),
+    ] = None,
     session: Annotated[str | None, typer.Option(help="Resume a specific session id")] = None,
     continue_last: Annotated[bool, typer.Option("--continue", "-c", help="Resume the most recent session")] = False,
 ) -> None:
@@ -208,6 +232,7 @@ def run(
         session=session,
         continue_last=continue_last,
         max_turns=max_turns,
+        permission=permission,
     )
 
     code = asyncio.run(run_noninteractive(setup.agent, " ".join(message).strip()))

mycode_cli-0.7.1/src/mycode_cli/permissions.py

@@ -0,0 +1,228 @@
+"""CLI permission policy built on SDK tool hooks."""
+
+from __future__ import annotations
+
+import shlex
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Literal, NamedTuple
+
+from mycode import Hooks, ToolExecutionResult, ToolHookContext
+from mycode.tools import resolve_path
+from mycode_cli.config import PermissionConfig, PermissionLevel, Settings
+from mycode_cli.system_prompt import discover_skills
+
+PermissionTier = Literal["readonly", "safe", "standard", "yolo"]
+PermissionDecision = Literal["allow", "ask", "deny"]
+ToolReviewDecision = Literal["allow", "deny"]
+
+PERMISSION_DENIED_OUTPUT = "error: permission denied"
+PERMISSION_DENIED_BY_USER_OUTPUT = "error: permission denied by user"
+
+_LEVEL_RANK: dict[PermissionLevel, int] = {"readonly": 0, "safe": 1, "standard": 2, "yolo": 3}
+
+_SHELL_CONTROL_TOKENS = {
+    "&&", "||", ";", "|", "|&", "&",
+    ">", ">>", ">|", "&>", ">&",
+    "<", "<<", "<<<", "<&",
+}  # fmt: skip
+
+_DANGEROUS_PROGRAMS = {
+    "rm", "rmdir", "mv", "cp", "sudo", "chmod", "chown",
+    "kill", "pkill", "dd", "mkfs", "mount", "umount", "shutdown", "reboot",
+}  # fmt: skip
+_DANGEROUS_GIT_SUBCOMMANDS = {"reset", "clean", "checkout", "restore"}
+
+# awk/sed are excluded: both can write files and shell out, and statically
+# parsing their scripts isn't worth it.
+_READONLY_PROGRAMS = {
+    "pwd", "ls", "dir", "tree", "rg", "grep", "cat", "head", "tail",
+    "wc", "stat", "file", "du", "df", "which", "env", "printenv",
+    "date", "uname", "whoami", "id", "hostname", "ps", "uptime",
+    "realpath", "dirname", "basename",
+    "sort", "uniq", "cut", "tr",
+}  # fmt: skip
+_READONLY_GIT_SUBCOMMANDS = {"status", "diff", "log", "show", "rev-parse", "ls-files", "grep", "blame", "describe"}
+_READONLY_BRANCH_FLAGS = {"-a", "-r", "-v", "-vv", "--all", "--remotes", "--verbose", "--show-current"}
+
+# find flags that write files or execute commands.
+_FIND_DANGEROUS_FLAGS = {
+    "-delete", "-exec", "-execdir", "-ok", "-okdir",
+    "-fprint", "-fprint0", "-fprintf", "-fls",
+}  # fmt: skip
+
+
+class PermissionCheck(NamedTuple):
+    tier: PermissionTier
+    preview: str
+
+
+@dataclass(frozen=True)
+class ToolReviewRequest:
+    tool_call_id: str
+    tool_name: str
+    preview: str
+    permission: PermissionConfig
+
+
+ToolReviewCallback = Callable[[ToolReviewRequest], Awaitable[ToolReviewDecision]]
+
+
+def build_permission_hooks(
+    settings: Settings,
+    *,
+    review: ToolReviewCallback | None = None,
+    on_user_denied: Callable[[], None] | None = None,
+) -> Hooks:
+    hooks = Hooks()
+    skill_roots = [Path(s.path).parent.resolve(strict=False) for s in discover_skills(settings.cwd)]
+
+    @hooks.before_tool
+    async def check_permission(ctx: ToolHookContext) -> ToolExecutionResult | None:
+        check = classify_tool(ctx, cwd=settings.cwd, project=settings.project, skill_roots=skill_roots)
+        decision = permission_decision(settings.permission, check.tier)
+        if decision == "allow":
+            return None
+
+        if decision == "ask" and review is not None:
+            review_decision = await review(
+                ToolReviewRequest(
+                    tool_call_id=ctx.tool_call_id,
+                    tool_name=ctx.tool_name,
+                    preview=check.preview,
+                    permission=settings.permission,
+                )
+            )
+            if review_decision == "allow":
+                return None
+            if on_user_denied is not None:
+                on_user_denied()
+            return ToolExecutionResult(output=PERMISSION_DENIED_BY_USER_OUTPUT, is_error=True)
+
+        return ToolExecutionResult(output=PERMISSION_DENIED_OUTPUT, is_error=True)
+
+    return hooks
+
+
+def permission_decision(permission: PermissionConfig, tier: PermissionTier) -> PermissionDecision:
+    if permission.level == "yolo":
+        return "allow"
+    if tier != "yolo" and _LEVEL_RANK[tier] <= _LEVEL_RANK[permission.level]:
+        return "allow"
+    return permission.mode
+
+
+def classify_tool(
+    ctx: ToolHookContext,
+    *,
+    cwd: str,
+    project: str,
+    skill_roots: list[Path],
+) -> PermissionCheck:
+    name = ctx.tool_name.lower()
+
+    if name == "bash":
+        command = str(ctx.tool_input.get("command") or "").strip()
+        return PermissionCheck(_classify_bash(command), command)
+
+    if name in {"read", "write", "edit"}:
+        raw = str(ctx.tool_input.get("path") or "")
+        path = Path(resolve_path(raw, cwd=cwd)).resolve(strict=False)
+        project_path = Path(project).resolve(strict=False)
+        preview = raw or str(path)
+        if name == "read" and any(path.is_relative_to(root) for root in skill_roots):
+            return PermissionCheck("readonly", preview)
+        if not path.is_relative_to(project_path):
+            return PermissionCheck("yolo", preview)
+        return PermissionCheck("readonly" if name == "read" else "safe", preview)
+
+    return PermissionCheck("yolo", ctx.tool_name)
+
+
+def _classify_bash(command: str) -> PermissionTier:
+    if not command:
+        return "yolo"
+    # Newlines and shell expansion bypass static analysis; treat as compound.
+    if "\n" in command or "\r" in command or "$(" in command or "`" in command:
+        return "yolo"
+    try:
+        lexer = shlex.shlex(command, posix=True, punctuation_chars=True)
+        lexer.whitespace_split = True
+        tokens = list(lexer)
+        words = shlex.split(command, posix=True)
+    except ValueError:
+        return "yolo"
+    if not words or any(t in _SHELL_CONTROL_TOKENS for t in tokens):
+        return "yolo"
+
+    program = Path(words[0]).name
+    if _is_dangerous(program, words):
+        return "yolo"
+    if _is_readonly(program, words):
+        return "readonly"
+    return "standard"
+
+
+def _is_dangerous(program: str, words: list[str]) -> bool:
+    if program in _DANGEROUS_PROGRAMS:
+        return True
+    if program == "sed" and any(w == "-i" or w.startswith("-i") for w in words[1:]):
+        return True
+    if program == "find" and any(w in _FIND_DANGEROUS_FLAGS for w in words[1:]):
+        return True
+    if program != "git":
+        return False
+    sub = _git_subcommand(words)
+    if sub in _DANGEROUS_GIT_SUBCOMMANDS:
+        return True
+    return sub == "push" and any(w in {"-f", "--force", "--force-with-lease"} for w in words[2:])
+
+
+def _is_readonly(program: str, words: list[str]) -> bool:
+    if len(words) == 2 and words[1] in {"--version", "-v", "version"}:
+        return True
+    if program in _READONLY_PROGRAMS:
+        return True
+    if program == "find":
+        return True
+    if program == "command" and words[1:2] == ["-v"] and len(words) >= 3:
+        return True
+    if program == "type" and len(words) >= 2:
+        return True
+    if program != "git":
+        return False
+    sub = _git_subcommand(words)
+    if sub in _READONLY_GIT_SUBCOMMANDS:
+        return True
+    if sub == "remote":
+        return not any(w in {"add", "remove", "rm", "rename", "set-url"} for w in words[2:])
+    if sub == "branch":
+        return all(w in _READONLY_BRANCH_FLAGS for w in words[2:])
+    return False
+
+
+def _git_subcommand(words: list[str]) -> str | None:
+    i = 1
+    while i < len(words):
+        w = words[i]
+        if w in {"-C", "-c", "--git-dir", "--work-tree"}:
+            i += 2
+            continue
+        if w.startswith("-"):
+            i += 1
+            continue
+        return w
+    return None
+
+
+__all__ = [
+    "PERMISSION_DENIED_BY_USER_OUTPUT",
+    "PERMISSION_DENIED_OUTPUT",
+    "ToolReviewCallback",
+    "ToolReviewDecision",
+    "ToolReviewRequest",
+    "build_permission_hooks",
+    "classify_tool",
+    "permission_decision",
+]

{mycode_cli-0.6.0 → mycode_cli-0.7.1}/src/mycode_cli/runtime.py

@@ -16,6 +16,7 @@ from mycode.providers import (
 from mycode.session import SessionStore
 from mycode.tools import DEFAULT_TOOL_SPECS
 from mycode_cli.config import ModelConfig, ResolvedProvider, Settings, provider_has_api_key
+from mycode_cli.permissions import ToolReviewCallback, build_permission_hooks
 from mycode_cli.system_prompt import build_system_prompt
 
 
@@ -51,6 +52,7 @@ def build_agent(
     session_id: str,
     max_turns: int | None = None,
     reasoning_effort: str | None = None,
+    review: ToolReviewCallback | None = None,
 ) -> Agent:
     """Build an agent from the resolved provider, honoring model config overrides.
 
@@ -59,7 +61,7 @@ def build_agent(
     """
 
     model_config = model_config_for(settings, resolved_provider)
-    return Agent(
+    agent = Agent(
         model=resolved_provider.model,
         provider=resolved_provider.provider,
         cwd=cwd,
@@ -78,6 +80,8 @@ def build_agent(
         system=build_system_prompt(cwd, settings),
         tools=DEFAULT_TOOL_SPECS,
     )
+    agent.hooks = build_permission_hooks(settings, review=review, on_user_denied=agent.cancel)
+    return agent
 
 
 def model_config_for(settings: Settings, resolved: ResolvedProvider) -> ModelConfig | None:
@@ -113,6 +117,7 @@ def clone_agent(agent: Agent, *, store: SessionStore, session_id: str) -> Agent:
         supports_pdf_input=agent.supports_pdf_input,
         system=agent.system,
         tools=DEFAULT_TOOL_SPECS,
+        hooks=agent.hooks,
     )